# affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via Product Image Import

- **ID:** WPSEC-2026-1502
- **Plugin:** affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (`affiliate-toolkit-starter`), https://wordpress.org/plugins/affiliate-toolkit-starter/
- **Affected versions:** all versions before 3.9.3
- **Fixed in:** 3.9.3 (Update to 3.9.3 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-434
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/affiliate-toolkit-starter
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1502/

## Description

The affiliate-toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the product image import in all versions up to, and including, 3.9.2. The extension of the saved file was taken from the attacker-supplied image URL and kept whenever the remote server answered with an unregistered 'image/' content type, which allowed files such as .php to be written to the uploads directory. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files to the server, which may make remote code execution possible. Exploitation requires the 'import product image' option to be enabled by an administrator.

## References

- https://wpsec.com/vuln/WPSEC-2026-1502/
- https://plugins.svn.wordpress.org/affiliate-toolkit-starter/tags/3.9.3/
- https://wordpress.org/plugins/affiliate-toolkit-starter/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1502/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.